From d3adafdd2872b0c625d888b06d1fa47a0de2292a Mon Sep 17 00:00:00 2001 From: Louis Varin Date: Fri, 14 Aug 2026 20:09:56 +0000 Subject: [PATCH] ci: pin third-party GitHub Actions to commit SHAs Replace floating version tags (v3, v6) with full 40-character commit SHAs for aws-actions/configure-aws-credentials, docker/build-push-action, docker/login-action, docker/setup-buildx-action, and dorny/paths-filter across claude-code.yaml, pull_request.yaml, and release-to-ghcr.yaml. Each pin retains a trailing version comment for readability. Floating tags can be repointed by the upstream maintainer (or an attacker who compromises their account) to inject malicious code into CI, since tags are mutable refs. Pinning to immutable commit SHAs closes that supply-chain attack surface, per the org-wide third-party action pinning policy (INF-2571). Ticket: INF-2714 Session-Id: 82bb60fb-74af-4eb0-980d-e679d6c0dedf Task-Id: 0b7e8841-a9ac-4e3e-af8c-61b160a2d06c --- .github/workflows/claude-code.yaml | 2 +- .github/workflows/pull_request.yaml | 6 +++--- .github/workflows/release-to-ghcr.yaml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/claude-code.yaml b/.github/workflows/claude-code.yaml index 09aee711..2db30051 100644 --- a/.github/workflows/claude-code.yaml +++ b/.github/workflows/claude-code.yaml @@ -34,7 +34,7 @@ jobs: uses: actions/checkout@v6 - name: Configure AWS Credentials (OIDC) - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: arn:aws:iam::199765120567:role/${{ github.event.repository.name }}-iam-protected aws-region: us-west-2 diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml index 795dc848..6025535f 100644 --- a/.github/workflows/pull_request.yaml +++ b/.github/workflows/pull_request.yaml @@ -58,7 +58,7 @@ jobs: - name: Check for dependency file changes id: filter - uses: dorny/paths-filter@v3 + uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 with: filters: | deps: @@ -103,10 +103,10 @@ jobs: uses: actions/checkout@v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: . push: false diff --git a/.github/workflows/release-to-ghcr.yaml b/.github/workflows/release-to-ghcr.yaml index 90dee7f8..55c69bac 100644 --- a/.github/workflows/release-to-ghcr.yaml +++ b/.github/workflows/release-to-ghcr.yaml @@ -92,17 +92,17 @@ jobs: uses: actions/checkout@v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: . push: true